Oracle provider Pragma attributed Nostra's September 17, 2026, $3.5 million borrowing exploit to a manipulated on-chain pool, finding no decimals or median-calculation errors in its reconstruction